CVE-2026-111329CWE-1392

CVE-2026-111329

Critical · published October 16, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00533 · 44.2th percentile
Weakness
CWE-1392 · Use of Default Credentials
Published
2026-10-16T02:19Z
References (6)
https://github.com/juggleim/im-server · [email protected]https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988 · [email protected]https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96 · [email protected]https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential · [email protected]https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console · [email protected]https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 15 OCT 21:43Z
    JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
    cvelistv5
  • 15 OCT 21:43Z
    JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
    cvelistv5